Conducting an Information Security Gap Analysis

An information security gap analysis is a necessary part of a business' risk management and business continuity programs. The analyses should be conducted on an ongoing, regular basis to prevent security breaches. Standards for gap analysis have been developed by the International Organization for Standardization (ISO), the Information Systems Audit and Control Association (ISACA), and the National Institute of Standards and Technology (NIST). The standards represent guidelines for the process of gap analysis, but should be used as a part of comprehensive business security plan. This report defines an Information Security Gap Analysis, looks at possible pitfalls, and provides a step-by-step implementation plan.